Privacy Policy
What Mamori stores, why it stores it, where it lives, how long it stays, and how to have it deleted.
1Who is responsible for your data
Cobra.01 on Discord is the controller of the personal data described here. The contact route for everything in this policy is a ticket in the Mamori support server at https://discord.gg/qnfcTVB7yG.
This policy covers the Mamori Discord application and the website at mamoribot.app. It does not cover Discord itself, which handles your account and your messages under its own privacy policy.
2What we collect
We collect the minimum needed to run a knowledge base bot and to stop it costing more than it earns.
- Discord identifiers. Your Discord user id, the server id, and the id of the channel a command was used in.
- Sign-in details. Your Discord display name and avatar hash, plus the list of servers where you hold Manage Server or Administrator. These sit in the sessions table and exist only to draw the website while you are signed in.
- Uploaded files. Documents a member uploads to the knowledge base, stored in Cloudflare R2, along with the file name, byte size, page count, a content hash and the id of the member who uploaded them.
- Extracted text. Each document is split into passages, and those passages are stored in the chunks table in Cloudflare D1.
- Embeddings. Numeric vectors generated from each passage, and from questions kept in the answer cache, stored in Cloudflare Vectorize.
- Unanswered questions. A question asked with the ask command that finds no close enough match is stored in the knowledge_gaps table with the question text, the id of the person who asked, the best match score and the time.
- Usage counters. Monthly AI usage and cache hits per server in guild_usage, and daily AI usage per person in user_usage.
- Cost logs. One row per AI request in ai_log holding the server id, user id, model name, token counts, neuron and dollar cost, whether it was a cache hit, and how long it took.
3What we do not collect
We do not ask for your real name, postal address, phone number or payment card details, and the bot never requests them. Payments are arranged manually and outside the product.
We do not read your server messages. Mamori only sees what is sent to it through a slash command or an interaction, and only in channels an admin has enabled.
4Why we process it, and on what basis
Discord identifiers, uploaded content, extracted text and embeddings are processed to provide the service you asked for. The lawful basis is performance of a contract.
Session records keep you signed in to the dashboard. The lawful basis is performance of a contract.
Usage counters, cost logs and unanswered question records are processed to enforce quotas, detect abuse, keep the service financially viable and show admins what their knowledge base is missing. The lawful basis is our legitimate interest in running the service safely, balanced against the very small amount of personal data involved.
We do not process your data for advertising, profiling or model training.
5Where it is stored and processed
Everything runs on Cloudflare. Workers runs the code, D1 holds the database, R2 holds uploaded files, KV holds cache bookkeeping keys, and Vectorize holds embeddings. Requests are served from the Cloudflare network.
The Subprocessors page lists every company that is involved, and there are not many.
6How the AI works, and who never sees your content
Answers and embeddings are generated with Cloudflare Workers AI. The answer model is @cf/meta/llama-3.1-8b-instruct-fp8-fast and the embedding model is @cf/baai/bge-base-en-v1.5. Both run inside Cloudflare.
Your documents and your questions are not sent to OpenAI, Anthropic, Google, Mistral or any other third party AI provider. No such integration exists in the product.
Uploaded content is not used to train any model, ours or anyone else's.
7Questions Mamori could not answer
When the ask command finds no passage above the match threshold, the question text is stored together with the id of the person who asked it, and the admins of that server can read it on the dashboard. This is deliberate. It is how admins find out what their documentation is missing.
Anything typed into the ask command may therefore be read by that server's admins. Do not put personal or sensitive information into a question.
To have a stored question removed, ask the server admins, or open a ticket in the support server with the server id and roughly when it was asked.
8How long we keep things
Retention is short where it can be, and tied to your own actions where it cannot.
- Website sessions expire after 7 days. The record is deleted when an expired session is next presented or when you sign out.
- Cached answers expire after 30 days. After that the cached pair is no longer served and its bookkeeping key lapses.
- Knowledge base content, meaning uploaded files, extracted passages and embeddings, is kept until a server admin runs the wipe command, or until we delete it at your request.
- Usage counters, cost logs and unanswered question records are kept while the server uses the service, and are deleted on request.
9Deleting a knowledge base
The wipe command removes that server's uploaded files from R2, its extracted passages, its document and collection records, its knowledge base embeddings and its cached answer embeddings. It affects that server only, and it cannot be undone.
The wipe does not remove usage counters, cost log rows, stored unanswered questions, or the record that a wipe happened. Open a ticket in the support server if you need those removed as well and we will do it.
Removing the bot from a server does not by itself delete the knowledge base. Wipe first, then remove, or ask us.
The history figure on your plan controls how far back the dashboard displays analytics. It is a display window, not a deletion schedule.
10Who we share it with
We share data with the companies on the Subprocessors page, and with nobody else.
We do not sell personal data and we do not share it for advertising.
We may disclose data where the law requires it, or where it is necessary to investigate abuse, fraud or a threat to someone's safety. Where we are allowed to tell you, we will.
11International transfers
Cloudflare runs a global network, so data may be stored or processed outside your country, including in the United States. Transfers out of the United Kingdom and the European Economic Area rely on the standard contractual clauses and the equivalent safeguards in Cloudflare's data processing addendum.
Open a ticket in the support server if you need a copy of the transfer terms we rely on.
12Your rights under the GDPR
If the UK GDPR or the EU GDPR applies to you, you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased
- restrict how we process it
- receive a copy in a portable, machine readable format
- object to processing we carry out on the basis of legitimate interest
- withdraw consent, where consent is what we relied on
13Using those rights
Open a ticket in the support server and say what you want. We will answer within one month, and we will tell you if we need longer because the request is complex.
We may ask you to prove you control the Discord account concerned, usually by confirming your Discord user id from the account that opened the ticket. We ask because most of what we hold is keyed to a Discord id and nothing else.
You can also complain to your data protection authority. In the United Kingdom that is the Information Commissioner's Office.
14California residents
We do not sell personal information. We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the last 12 months.
You have the right to know what we collect, to request deletion, to request correction, and to not be treated differently for using those rights. Send the request by opening a ticket in the support server.
We offer no financial incentive in exchange for personal information.
15Security
The measures in place are the ones a service of this size can actually maintain.
- The site is served over HTTPS only, and the session cookie is HttpOnly, Secure and SameSite=Lax.
- Session cookies carry a random id and an HMAC-SHA256 signature, checked in constant time before any session is loaded.
- Discord interactions are signature verified against the application's public key before anything is processed.
- Knowledge base lookups are filtered by server id both at the vector store and in the database, so one server cannot retrieve another server's content.
- Uploads are limited by extension and size, and duplicate files are detected by content hash rather than re-stored.
- Access to production data is limited to the operator.
16Reporting a vulnerability
Report anything you find by opening a ticket in the support server. Do not exploit it, do not access other people's data with it, and give us a reasonable chance to fix it before publishing.
We will acknowledge a report within 5 working days and tell you when it is fixed.
17Children
Mamori is not directed at children. We rely on Discord's minimum age requirement and do not knowingly collect data from anyone below it.
If you believe a child's personal data has been uploaded into a knowledge base or stored in a question, open a ticket in the support server and we will remove it.
18Changes to this policy
We may update this policy. The effective date at the top of this page changes when we do, and a material change is posted here before it takes effect.
19Contact
Open a ticket in the Mamori support server at https://discord.gg/qnfcTVB7yG. That is the only support route. There is no email address and no phone line.